Safe Attachments Policy (Octiga)
Microsoft Defender for Office 365 Safe Attachments scans email attachments in a virtual sandbox environment before delivering them to recipients. The Default policy defines how attachments are handled when malware is detected, helping protect users from zero-day malware and other malicious content delivered via email.
Settings this baseline controls
| Setting | What it does |
|---|---|
| Policy name | The name of the Safe Attachments policy. The Default policy applies to all users without a specific policy assignment. Learn more |
| Safe Attachments enabled | Enables or disables the Safe Attachments policy. When enabled, email attachments are scanned in a sandbox before delivery. Learn more |
| Unknown malware response | The action to take when malware is detected in an attachment. Options: Allow (off, no scanning), Block (block and quarantine the message), DynamicDelivery (deliver the message with a placeholder, replace with the original after scanning). Learn more |
| Quarantine policy | The quarantine policy applied to messages that are quarantined by Safe Attachments. Determines end-user permissions for quarantined messages. Learn more |
| Redirect enabled | Whether to redirect messages containing detected malware to a specified email address. Used in audit scenarios. Learn more |
| Redirect email address | The email address to redirect messages to when malware is detected, if Redirect is enabled. Learn more |
Configure it
This baseline turns on Safe Attachments, which scans email attachments in a sandbox before they’re delivered.
-
Add the baseline.
Add it to the tenant directly (see Adding a baseline), or deploy it as part of a scheme (see Deploying a scheme).
-
Turn it on and set the response to malware.
Set Safe Attachments enabled on and Unknown malware response to
Block, so a detected attachment is quarantined along with its message rather than delivered with a placeholder or allowed through unscanned. -
Set the quarantine policy.
Set Quarantine policy to
AdminOnlyAccessPolicy, so only an admin can release a message Safe Attachments has quarantined. -
Leave redirection off.
Leave Redirect enabled off. Redirecting detected malware to a separate mailbox is mainly useful for auditing and isn’t needed for standard protection.
-
Check where this policy sits relative to any others.
Octiga creates and manages its own policy, named Octiga Safe Attachment Policy, rather than editing an existing one. Safe Attachments policies apply in priority order, and a Strict or Standard preset security policy assigned to the same recipients is evaluated first. If a preset already covers everyone this baseline targets, this policy’s settings never take effect for them (see Preset EOP Policy (Standard) and Preset EOP Policy (Strict)).
-
Save.
Turn on Auto-remediation if you want Octiga to reapply this whenever it’s changed (see Remediation).
Check it worked
Passing means the Octiga Safe Attachment Policy exists, is on, and matches these settings. Check it in the Microsoft Defender portal, under Email & collaboration → Policies & rules → Threat policies → Safe attachments. Users don’t see attachments being scanned; they notice only when one is quarantined.
Standards this addresses
Doing this for every tenant?
Step through the deploy wizard to apply a scheme to a tenant, groups or users, and see what Managed and Direct do at deploy time.